EP3374872A1

EP3374872A1 - Method for controlling the operating state of a system by redundancy

Info

Publication number: EP3374872A1
Application number: EP16793897.6A
Authority: EP
Inventors: Arnaud GRASSET
Original assignee: Thales SA
Current assignee: Thales SA
Priority date: 2015-11-10
Filing date: 2016-11-09
Publication date: 2018-09-19
Anticipated expiration: 2036-11-09
Also published as: WO2017081095A1; EP3374872B1; FR3043479B1; FR3043479A1

Abstract

The invention concerns a method for controlling the operating state of a system comprising at least one first member, the method comprising the steps of: - selection of a first task, that can be executed in a first allocated time, - first execution by the first member of the first selected task, the first execution making it possible to obtain a first result and defining a first time period, - first testing of a first condition according to which the first time period is less than the first allocated time, when the first condition is fulfilled, the method also comprises: - implementation of at least one second execution of the same first task by the same first member in order to obtain a second result, - comparing the first result with each second result, and - determining the operating state of the system.

Description

Method for controlling the operating state of a system by redundancy

The present invention relates to methods for controlling the operating state of a system. The present invention also relates to associated controllers of the operating state of a system. The present invention also relates to a transport apparatus comprising such a controller.

In the field of avionics, the response times of aircraft control systems must be strictly guaranteed to prevent the occurrence of accidents. Therefore, to ensure compliance with response times, real-time systems are embedded in aircraft. Real-time systems are computer systems that differentiate themselves from other computer systems by taking into account time constraints whose respect is as important as the accuracy of the result delivered by the system.

For such real-time systems, it is therefore vital to ensure a high level of reliability while ensuring that real-time constraints are met. A system is considered reliable when the probability of the system fulfilling its assigned mission over a given period of time corresponds to the probability specified in the specifications.

Compliance with real-time constraints is very often obtained by estimating the "worst execution time" of each system task and then adding design margins to the worst execution times estimated. The worst execution time of a task (WCET for Worst Case Execution Time) is defined as the longest time for the task to run on a given hardware platform.

However, since such margins are relatively large, the performance requirements of real-time systems are oversized compared to real needs, which penalizes performance and limits the functionalities that can be implemented on such systems.

In addition, the components of real-time systems are subject to wear and failure mechanisms, intrinsic to the technologies used for these components. In particular, the semiconductor-based components are the target of cosmic radiation or electromagnetic interference inducing transient faults during the execution of the tasks of the systems, while manufacturing defects and degradation of the components during their lifespan induces permanent faults. Such phenomena therefore induce a reduction in the reliability of the real-time systems. There is therefore a need to improve the reliability of real-time systems without degrading the performance of such systems.

To this end, the subject of the invention is a method for controlling the operating state of a system, the system comprising at least a first member capable of performing tasks, the method comprising the steps of:

selecting a first task to be executed by the first member, the first task being executable at a first allocated time,

first execution by the first member of the first selected task, the first execution by the first member of the first task making it possible to obtain a first result and defining a first period of time;

first test of a first condition according to which the first period of time is less than or equal to the first time allowed,

when the first condition is fulfilled, the method also comprises the steps of:

implementing at least one second execution of the same first task by the same first member during a second period of time, each second execution making it possible to obtain a second result,

comparing the first result with each second result, and

determination of the operating state of the system as a function of the comparison step.

According to particular embodiments, the control method comprises one or more of the following characteristics, taken separately or in any technically possible combination:

when the first condition is not fulfilled, the method also comprises a step of waiting for a waiting time, then repetition of the selection, first execution and first test steps, the sum of the waiting time and the first period of time being equal to a multiple of the first allocated time.

when the first condition is not fulfilled and the first period of time is less than or equal to a predetermined duration, the method also comprises the steps of implementing at least a second execution, comparison and determination.

The invention also relates to a method for controlling the operating state of a system, the system comprising at least a first member capable of performing tasks, the method comprising the steps of: selecting a first task to be executed by the first member, the first task being executable at a first allocated time,

first execution by the first member of the first selected task during a first period of time, the first period of time being less than or equal to the first allocated time,

first test of a first condition according to which the first execution of the first task is completed,

when the first condition is fulfilled, the method also comprises the steps of:

obtaining the result of the first execution of the first task by the first member making it possible to obtain a first result,

comparing the first result with at least a second result, each second result being obtained by implementing a spatial and / or temporal redundancy, and

According to particular embodiments, the preceding control method comprises one or more of the following characteristics, taken separately or in any technically possible combination:

the first condition is not fulfilled, the method also comprises a step of completion of the first task, a part of which was implemented during the first execution, making it possible to obtain the first result.

the system comprises a second member and a third member, the second member and the third member being capable of performing tasks, the method comprising the steps of:

second execution of the same first task by the second member during a second period of time, the second execution being implemented in parallel with the first execution, the second execution making it possible to obtain a second result when the first condition is fulfilled,

third execution of a second task by the third member during a third period of time, the third execution being implemented in parallel with the first execution and the second execution,

second test of a second condition according to which the third execution of the second task is completed, when the first condition and the second condition are met, the method also includes a fourth execution step of the first task by the third member during a fourth period of time, the fourth execution providing another second result.

when the first condition is fulfilled, the method also comprises a step of implementing at least two other executions of the first task by the same first member, each other execution making it possible to obtain a second result.

the step of determining the operating state is implemented by using a vote among the first result and the at least two second results.

for each task, a maximum execution time is defined, the allocated time being a function of the number of redundant executions of the task's time type and the maximum execution time of the task.

the time allowed is equal to the ratio between the maximum execution time of the task and the number of redundant time-type executions of the task.

the selected task is decomposable into a first number of sub-tasks and in which, when the first condition is not fulfilled, the method further comprises a step of executing a second number of sub-tasks of the task selected, the second number being strictly less than the first number of subtasks.

- When the first condition is not met and the first result is obtained, the method further comprises a step of checking the relevance of the first result obtained.

The invention also relates to a controller of the operating state of a system, the system comprising at least a first member capable of performing tasks, the controller being able to implement the following steps:

first test of a first condition according to which the first period of time is less than or equal to the first time allowed, when the first condition is fulfilled, the controller also being able to implement the steps of:

comparing the first result with each second result, and

The invention further relates to another controller of the operating state of a system, the system comprising at least a first member capable of performing tasks, the controller being adapted to implement the following steps.

when the first condition is fulfilled, the controller also being able to implement the steps of:

The invention also relates to a transport apparatus comprising one of the controllers described above.

Other features and advantages of the invention will appear on reading the following description of embodiments of the invention, given by way of example only and with reference to the drawings which are:

FIG. 1 is a diagrammatic view of an example of a controller for implementing a method for controlling the operating state of a system, FIG. 2, a flowchart for a first implementation example. implementing a method for controlling the operating state of a system, FIG. 3, a diagrammatic representation of a redundant time-type execution of a task on an organ, each execution of the task on the organ being performed over a period of time less than or equal to the worst execution time of the task,

FIG. 4, a schematic representation of a redundant time-type execution of a task on an organ only when the execution time of the task during the first execution is less than or equal to half of the worst execution time of the task,

FIG. 5, a schematic representation of a redundant time-type execution of a task on an organ only when the execution time of the task during the first execution is less than or equal to one-third of the worst execution time of task,

FIG. 6, a schematic representation of a redundant time-type execution of a task on an organ when the execution time of the task during the first execution does not fulfill the condition of FIG. 5 but has been executed on a period of time less than or equal to half the execution time of the task,

FIG. 7, a flowchart of a second exemplary implementation of a method for controlling the operating state of a system,

FIG. 8, a schematic representation of a redundant spatial-type execution of two tasks on two organs only when a first condition is verified,

FIG. 9 is a diagrammatic representation of a redundant spatial-type execution of two tasks on three organs only when a first condition and a second condition are verified,

FIG. 10, a schematic representation of a redundant time-type execution of a task, the second execution of the task being degraded when the first condition is not verified, and

- Figure 1 1, a schematic representation of a verification of the relevance of the result obtained after the first execution of a task when the first condition is not verified.

A system 1 and a controller 2 of the operating state of the system 1 are illustrated in FIG.

System 1 is, for example, a real-time system. In the example of FIG. 1, the system 1 is embedded in a transport apparatus 3, such as a automobile or an aircraft, for which the respect of time constraints is a critical parameter.

The system 1 comprises a set of organs d, ..., O _n and a set of tasks T ₁ .., T _n . In the example of Figure 1, three organs d, 0 _2, 0 ₃ of the system 1 are shown. The organs d, ..., O _n are architectural elements fulfilling a predetermined function. The organs d, ..., O _n are also called "processor cores". The tasks ΤΊ, ..., T _n are sequences of instructions executable on the organs 0 ₁ .., O _n of the system 1. The instruction sequences are, for example, relating to commands of the system 1. When the system 1 is embarked in an aircraft, the commands are, for example, commands for changing the trajectory or landing of the aircraft.

The controller 2 interacts with the system 1 to control the operating state of the system 1. The operating state of a system is achieved by performing fault tests on the system and determining the reliability of the system.

In the example of Figure 1, the controller 2 is embedded in the same equipment as the system 1 controlled by the controller 2, for example in a transport device.

The controller 2 is, for example, a computer.

More generally, the controller 2 is an electronic calculator adapted to manipulate and / or transform data represented as electronic or physical quantities in the registers of the controller 2 and / or memories in other similar data corresponding to physical data in data. memories, registers or other types of display, transmission or storage devices.

The controller 2 comprises a processor comprising a data processing unit, memories and an information carrier reader.

The controller 2 is able to interact with a computer program product comprising a readable piece of information readable by the controller 2, usually by the data processing unit of the controller 2. On the readable medium of information is stored a computer program comprising program instructions.

The computer program is loadable on the data processing unit of the controller 2 and is adapted to cause the implementation of a method of controlling the operating state of the system 1.

The operation of the controller 2 interacting with the computer program product and the system 1 is now described with reference to FIG. schematically a first example of implementation of a method for controlling the operating state of a system 1.

Alternatively, the controller 2 is a software application implemented on the same organs d, ..., O _n that the tasks T ₁ .., T _n.

Initially, the control method comprises a step 100 of allocating, by the controller 2, a time allocated to each task T ₁ .., T _n of the system 1.

The allocated time of each task T ₁ .., T _n is less than or equal to the worst execution time, also called maximum execution time, previously estimated for the task T ₁ .., T _n . In particular, the time allocated is equal to the ratio between the worst execution time of the task T ₁ .., T _n and the number of redundant execution of the time type of the task T ₁ .., T _n . For example, the time allocated for each task T ₁ .., T _n is equal to half or third of the worst execution time estimated for the task T ₁ .., T _n .

The worst execution time, designated by the WCET reference in the remainder of the description, is, for example, estimated or limited in advance by experimental measurements, static code analysis methods or hybrid methods.

The control method also comprises a step 1 10 for selecting a first task ΤΊ to be executed by the first member d of the system 1. The first task ΤΊ is, for example, selected from a static task scheduling defined during the design of the system 1. The first task ΤΊ is executable at first allocated Ai fixed by the controller 2.

The control method then comprises a step 120 of first execution by the first member d of the first task ΤΊ _. At the end of the first execution, a first result is obtained and a first period of time -ι is defined. The first time period -ι is the duration set for the execution of the first task ΤΊ on the first organ d.

The control method then comprises a step 130 of first testing a first condition. The first condition states that the first period of time is less than or equal to the first time allowed A ^

When the first condition is not fulfilled, the method comprises a step 140 of waiting for a waiting time, then of repeating the selection steps 1 10, the first execution 120 and the first test 130. The sum of the time and the first period of time is equal to a multiple of the first time allocated A ^ Such a sum is greater than or equal to the worst execution time WCET of the task considered. For example, the sum is twice the first time allocated or three times the first time allocated Ai. When the first condition is fulfilled, the control method comprises a step 150 of implementing at least a second execution of the same first task Ti by the same first member d during a second period of time Δ ₂ . Each second run gives a second result.

The second executions are redundant time-type executions of the first task T The redundant time-type execution of a task is the sequential execution of the same task on the same organ.

The example of FIG. 3 illustrates the redundant time-type execution of a first task ΊΊ on the same first member d during a first time period Δ _1; then during a second period of time Δ ₂ . The first time allocated A ^ is in this example equal to the worst execution time WCET of the first task T The first period of time being less than or equal to the first time allocated A _1; the redundant execution of the first task ΤΊ on the same first member d is allowed.

In the example of FIG. 4, the first time allocated A ^ is equal to half the worst execution time WCET of the first task TV When the first condition is fulfilled, the first task ΤΊ is executed twice in a row on the same first member d, as illustrated in the upper drawing of FIG. 4. When the first condition is not satisfied, the first task ΤΊ is executed only once on the first member d, as illustrated in FIG. the bottom drawing of Figure 4.

In the example of FIG. 5, the first allocated time Ai is equal to one third of the worst execution time WCET of the first task When the first condition is fulfilled, the first task is executed three times in succession on the same first member d, as illustrated in the top drawing of FIG. 5. Such a redundant execution is called "triple redundancy". When the first condition is not satisfied, the first task is performed only once on the first member d, as shown in the bottom drawing of Figure 5.

The method then comprises a step 160 of comparing the first result with each second result obtained and of each second result between them.

For example, in the case where a first result and two second results are obtained, if only the first result is erroneous, the comparisons of the first result with each of the second results will have differences. In addition, the comparison of the second results between them will lead to the conclusion that the second results are correct and that the first result is wrong.

Then, the method comprises a step 170 for determining the operating state of the system 1 as a function of the comparison step 160. When the results obtained are identical, system 1 is considered "reliable" and steps 110 to 160 are repeated.

When the results obtained are not identical, this indicates that an error occurred during the execution of the task. The system 1 is then considered "faulty". In this case, an alarm is generated to inform the operator of a system fault 1.

In particular, a simple redundancy, that is to say two successive executions of a task on an organ, as illustrated in FIGS. 3 and 4, makes it possible to detect a failure of the system 1 without correcting it. A triple redundancy as illustrated in FIG. 5 makes it possible to detect a failure of the system 1 and to correct it by making a vote between the three results obtained when two results are identical.

As a variant, for the triple or higher redundancies, when the first condition is not fulfilled but the first period of time is less than or equal to a predetermined duration for the task, the method still implements the steps 150 to 1 70. Redundancy is said to be performed in "degraded mode".

FIG. 6 illustrates an example of redundancy implemented in degraded mode. In this example, the first time allocated Ai for the first task ΤΊ is equal to one third of the worst execution time WCET and the predetermined duration for the first task ΤΊ is equal to half the worst execution time WCET. Thus, although the first time period -i is greater than the first time allocated A _1; the first task T- _\ is executed a second time on the same first organ d. On the other hand, the first task T- _\ can not be executed a third time. Thus, in the case of triple redundancy, operation in degraded mode can detect a failure of the system 1, but does not correct it.

Thus, the method uses, on the one hand, the temporal redundancy to address the problems related to the degradation of the reliability of the components and, on the other hand, an adaptive scheduling of the tasks to allow a reduction of the margins taken on the worst time execution of each task.

In particular, slots, called "slots" in English, are statically allocated to each task to allow redundant execution of tasks and a comparison of the results obtained. In the case of exceeding a time interval, the task scheduling is dynamically changed so that the time slots for redundant job executions allow jobs to finish executing. Thus, the scheduling of the tasks is modified so that the time margins of the worst execution time are absorbed in the time slots initially provided for the redundancy. In addition, allocating lower allocated times to worst execution times reduces design margins.

Thus, the implementation of a redundant execution of tasks

ΤΊ, ..., Τ _η of the system 1 makes it possible to control the operating state of the system 1 and thus to improve the reliability of the system 1. The test steps make it possible to implement the redundant execution of the tasks T ₁ .., T _n only when such redundancy does not degrade the performance of the system 1. This makes it possible to respect the temporal constraints of the real-time systems.

According to a second mode of implementation, as illustrated in FIG. 7, the control method comprises the following steps.

The control method comprises allocation and selection steps 200 0 identical to the allocation 100 and selection 1 1 0 steps of the method according to the first implementation example.

The control method then comprises a step 220 of first execution by the first member d of the first task ΤΊ during a first period of time. The first period of time is less than or equal to the first time allocated Ai.

Then, the control method comprises a first test step 230 of a first condition. The first condition states that the first execution of the first task ΤΊ is completed.

When the first condition is not fulfilled, the control method comprises a step 240 of completion of the first task ΤΊ part of which was implemented during the first execution step 220. At the end of the first execution, a first result is obtained.

Then, the selection steps 21 0, first execution 220 and first test 230 are repeated.

When the first condition is fulfilled, a first result is obtained after the first execution.

In addition, the method comprises a step 250 of implementing a redundancy of time and / or space type. The redundant spatial-type execution of a task is the execution of the same task in parallel on different organs. The time-type redundancy is implemented in a manner similar to the first implementation example.

The step 250 of implementing a redundancy makes it possible to obtain at least a second result. The example of FIG. 8 illustrates the redundant temporal and spatial execution of a first task ΤΊ and a second task T ₂ on a first member d and a second member 0 ₂ . In this example, the first task ΤΊ is executed on the first member d in parallel with the second task T ₂ executed on the second member 0 ₂ . As illustrated in the drawing at the top of FIG. 8, when the first condition is satisfied for each task ΤΊ, T ₂ , the first task ΤΊ, respectively the second task T ₂ is executed redundantly on the second member 0 ₂ , respectively on the first organ d. As illustrated in the bottom drawing of FIG. 8, the first task ΤΊ that does not satisfy the first condition is not performed redundantly on the other member 0 ₂ . On the other hand, the second task T ₂ fulfilling the first condition is executed by a time-type redundancy on the same organ 0 ₂ .

The example of FIG. 9 illustrates the execution of a temporal redundancy and of a triple spatial redundancy of a first task ΤΊ and a second task T ₂ on three organs d, 0 ₂ , 0 ₃ of the system 1 . First, the first task ΤΊ is executed in parallel by a spatial type redundancy on the first member d during a first period of time and on the second member 0 ₂ during a second period of time. When the first condition is fulfilled, the first execution of the first task ΤΊ on the first member d makes it possible to obtain a first result and the second execution makes it possible to obtain a second result.

In parallel with the first execution and the second execution of the first task ΤΊ, the second task T ₂ is executed during a third period of time on the third member 0 ₃ . Then, the method comprises a second test step of a second condition in which the third execution of the second task T ₂ is completed. When the second condition is fulfilled, the third execution makes it possible to obtain a third result.

When the first and second conditions are fulfilled, the first task ΤΊ is performed redundantly on the third member 0 ₃ to obtain a second result and the second task T ₂ is performed redundantly on the first member d and on the second organ 0 ₂ . Such a situation is illustrated in the drawing at the top of Figure 9.

When the first condition is not satisfied, the method finishes executing the first task ΤΊ on the first member d but interrupts the second execution of the first task ΤΊ on the second member 0 ₂ .

If the second condition is satisfied, the method executes again the second task T ₂ on the third member 0 ₃ , as well as on the second member 0 ₂ for which the execution of the first task ΤΊ has been interrupted. Such a situation is illustrated in the middle drawing of Figure 9.

If the second condition is not satisfied, the first task ΤΊ and the second task T ₂ are not performed redundantly. Such a situation is illustrated in the bottom drawing of Figure 9.

Then, the control method comprises comparison steps 260 and determination 270 identical to the comparison steps 160 and determination 170 of the method according to the first implementation example.

In particular, when at the end of the step 250 of implementation of a redundancy, at least two second results are obtained, the determination step 270 is implemented by making a vote between the first result and at least two second results.

The benefits cited for the first implementation example also apply for the second implementation example.

In addition, the spatial redundancy has the advantage of detecting permanent faults, affecting several executions, as transient faults, affecting a single execution, and this unlike the temporal redundancy that can detect only transient faults. Thus, a permanent failure of a body of the system 1 is likely to be detected.

It will be understood by those skilled in the art that the invention is not limited to the described embodiments, nor to the particular examples of the description.

For example, the first task ΤΊ selected is decomposable into a first number of sub-tasks and when the first condition is not fulfilled, the method further comprises a step of executing a second number of sub-tasks of the task ΤΊ selected. The second number of subtasks is strictly less than the first number of subtasks. Thus, as illustrated in FIG. 10, when the first condition is not satisfied for a first task ΤΊ executing on a first member 0 _1; the first task ΤΊ is still performed redundantly on the same first member d but in "degraded" mode, that is to say that the execution time is decreased but in return the result obtained is less accurate. The comparison step then consists in comparing the order of magnitude of the results obtained with a previously fixed tolerance. If the comparison is considered positive, the results obtained during the first execution, that is to say during the non-degraded execution, are used.

As a variant and as illustrated in FIG. 11, when the first condition is not fulfilled, the method also includes a step of verifying the relevance of the first result obtained. For example, the verification step consists in verifying that the first result obtained is within a range of predetermined values.

Claims

1. - A method for controlling the operating state of a system (1), the system (1) comprising at least a first member (d) capable of performing tasks (T ₁ .., T _n ), the method comprising the steps of:

selecting (1 10) a first task (ΤΊ) to be executed by the first member (d), the first task (ΤΊ) being executable at a first allocated time (Ai),

first execution (120) by the first member (d) of the first task (ΤΊ) selected, the first execution by the first member (d) of the first task (ΤΊ) making it possible to obtain a first result and defining a first period of time (Δ ^,

first test (130) of a first condition according to which the first period of time (Ai) is less than or equal to the first allocated time (A ^,

when the first condition is fulfilled, the method also comprises the steps of:

implementing (150) at least one second execution of the same first task (ΤΊ) by the same first member (d) during a second period of time (Δ ₂ ), each second execution making it possible to obtain a second result,

comparing (160) the first result with each second result, and

determination (170) of the operating state of the system (1) as a function of the comparison step (160).

2. - The method of claim 1, wherein when the first condition is not met, the method also comprises a step (140) of waiting for a waiting time, then repetition of the selection steps (1). ), the first execution (120) and the first test (130), the sum of the waiting time and the first time period (Ai) being equal to a multiple of the first allocated time (A ^.

The method according to claim 1 or 2, wherein when the first condition is not fulfilled and the first time period (Δ ^ is less than or equal to a predetermined time, the method also includes the steps of at least a second execution (150), comparison (160) and determination (170).

4. - Method for controlling the operating state of a system (1), the system (1) comprising at least a first member (d) capable of performing tasks (T ₁ .., T _n ), the method comprising the steps of: selecting (210) a first task (ΤΊ) to be executed by the first member (d), the first task (ΤΊ) being executable at a first allocated time (Ai),

first execution (220) by the first member (d) of the first task (ΤΊ) selected during a first period of time, the first period of time being less than or equal to the first allocated time (Ai),

first test (230) of a first condition according to which the first execution of the first task (ΤΊ) is completed,

when the first condition is fulfilled, the method also comprises the steps of:

obtaining the result of the first execution of the first task (ΤΊ) by the first member (d) making it possible to obtain a first result,

comparing (260) the first result with at least a second result, each second result being obtained by implementing (250) a spatial and / or temporal type redundancy, and

determination (270) of the operating state of the system (1) as a function of the comparison step (260).

5. - Method according to claim 4, wherein when the first condition is not fulfilled, the method also comprises a step (230) of completion of the first task (ΤΊ) a part of which has been implemented at the first execution (220), to obtain the first result.

6. - Method according to claim 4 or 5, wherein the system (1) comprises a second member (0 ₂ ) and a third member (0 ₃ ), the second member (0 ₂ ) and the third member (0 ₃ ) being adapted to perform tasks (T ₁ .., T _n ), the method comprising the steps of:

second execution of the same first task (ΤΊ) by the second member (0 ₂ ) during a second period of time, the second execution being implemented in parallel with the first execution, the second execution making it possible to obtain a second result; when the first condition is met,

third execution of a second task (T ₂ ) by the third member (0 ₃ ) during a third period of time, the third execution being implemented in parallel with the first execution and the second execution,

second test of a second condition according to which the third execution of the second task (T ₂ ) is completed,

when the first condition and the second condition are met, the method also includes a fourth execution step of the first task (ΤΊ) by the third organ (0 ₃ ) during a fourth period of time, the fourth execution making it possible to obtain another second result.

7. - Method according to any one of claims 4 to 6, wherein when the first condition is fulfilled, the method also comprises a step of implementing at least two other executions of the first task (ΤΊ) by the same first member (d), each other execution to obtain a second result.

8. - Method according to any one of claims 6 or 7, wherein the step of determining (270) the operating state is implemented by using a vote among the first result and the at least two second results.

9. - Method according to any one of claims 1 to 8, wherein for each task (ΤΊ, ..., T _n ), it is defined a maximum execution time, the time allocated being a function of the number of redundant time-type executions of the task (T ₁ .., T _n ) and the maximum execution time of the task (T ₁ .., T _n ).

The method according to claim 9, wherein the time allocated is equal to the ratio between the maximum execution time of the task (T ₁ .., T _n ) and the number of redundant time-type executions of the task. (T ₁ .., T _n ).

1 1. A method according to any one of claims 1 to 10, wherein the selected task (ΤΊ) is decomposable into a first number of subtasks and wherein, when the first condition is not fulfilled, the method includes in addition to a step of executing a second number of sub-tasks of the task (ΤΊ) selected, the second number being strictly less than the first number of sub-tasks.

12. - Method according to any one of claims 1 to 10, wherein, when the first condition is not met and the first result is obtained, the method further comprises a step of verifying the relevance of the first result. got.

13. - Controller (2) of the operating state of a system (1), the system (1) comprising at least a first member (C ^) capable of performing tasks CT -, T _n ), the controller (2) being able to implement the following steps: selecting (1 10) a first task (ΤΊ) to be executed by the first member (d), the first task (ΤΊ) being executable at a first allocated time (Ai),

- comparing (160) the first result with each second result, and - determining (170) the operating state of the system (1) according to the comparison step (160).

14.- controller (2) of the operating state of a system (1), the system (1) comprising at least a first member (d) capable of performing tasks (ΤΊ, ..., T _n ) , the controller (2) being adapted to implement the following steps.

selecting (210) a first task (ΤΊ) to be executed by the first member (d), the first task (ΤΊ) being executable at a first allocated time (Ai),

15. A transport apparatus comprising a controller (2) according to claim 13 or 14.